EU AI Act Art.55 Downstream Provider Obligations: What GPAI API Users Can Demand — Developer Guide (2026)

EU AI Act Article 55 answers a practical question that every SaaS developer building on top of a GPAI API faces: what information is the upstream GPAI provider legally required to give me, and what can I contractually demand to ensure my own EU AI Act compliance?

Art.55 is the information chain article of Chapter V. Where Art.52 requires GPAI providers to compile technical documentation internally, and Art.53 imposes enhanced obligations on systemic risk providers, Art.55 requires that documentation and information flow downstream — to the AI system providers and deployers that integrate GPAI models into their products.

Art.55 became applicable on 2 August 2025 as part of Chapter V of the EU AI Act (Regulation (EU) 2024/1689). For downstream integrators — companies calling the OpenAI API, Anthropic API, Google Gemini API, or open-weight models like Llama — Art.55 creates directly actionable legal entitlements. If your API provider is subject to the EU AI Act, you have a right to receive the information Art.55 mandates. If they refuse, they are in breach of Art.55, and you can document that breach as a compliance risk in your own Art.9 risk management file.

For EU infrastructure providers and PaaS operators — including sota.io — Art.55 is a competitive argument: EU-established providers that document their Art.55 compliance package create a procurement advantage with enterprise customers who must demonstrate their own AI Act compliance chain.

Art.55 in the Chapter V GPAI Obligation Cascade

Art.55 sits at the downstream end of the Chapter V obligation structure:

Art.55 is not a new standalone obligation — it is the transmission mechanism that makes Art.52 and Art.53 documentation actionable for downstream providers. Art.52 creates the documentation; Art.55 requires it to flow to integrators. Without Art.55, a GPAI provider could technically compile compliant documentation internally but never share it, leaving downstream providers unable to demonstrate their own compliance.

Art.55(1): Baseline Information Obligations for All GPAI Providers

Art.55(1) applies to all GPAI model providers — both general tier and systemic risk tier. It requires providers to make available to downstream AI system providers, at a minimum:

Mandatory Information Set Under Art.55(1)

What "Make Available" Means

Art.55(1) does not specify the format or channel for making information available. In practice:

• API documentation portal: Model card and capability documentation embedded in the provider's developer documentation
• Downloadable technical package: PDF or structured data package containing Annex XI documentation
• API-accessible metadata endpoint: Machine-readable model card available via an API call (e.g., GET /v1/models/{model_id}/compliance)
• Contractual disclosure: Technical documentation delivered via contract exhibit as part of API terms of service
• EU AI Database registration: Art.71 registration that references public documentation URLs

The minimum standard is that a downstream provider who has signed up for the API and accepted the terms of service can access the Art.52 documentation without additional request. It should be proactively available, not provided only on demand.

The "Intend to Integrate" Threshold

Art.55(1) triggers the obligation when a downstream provider "intends to integrate the general-purpose AI model into their AI system." This creates a question: at what point does intent crystallise?

Art.55(2): Enhanced Information for Systemic Risk GPAI Providers

Art.55(2) imposes additional disclosure obligations on GPAI providers with systemic risk (the Art.51(1)(a) ≥10^25 FLOPs tier, or Commission-designated models). Downstream integrators of OpenAI GPT-4, Google Gemini Ultra, Anthropic Claude Opus-class models, or future Commission-designated models are entitled to the Art.55(2) package.

Art.55(2) Enhanced Disclosure Package

What Downstream Developers Can Do With Art.55(2) Information

The Art.55(2) information package directly supports downstream compliance obligations:

• Art.9 Risk Management: Adversarial testing summaries become input to the downstream provider's risk management system — "we identified CBRN uplift risk [below/above threshold X] based on upstream provider Art.55(2) disclosure"
• Art.10 Training Data: If the downstream provider further fine-tunes on GPAI outputs, cybersecurity documentation informs data provenance tracking
• Art.12 Logging: Serious incident history informs what events the downstream provider should log as elevated-risk outputs
• Art.13 Transparency: The upstream model card content feeds directly into the downstream provider's instructions-for-use documentation for deployers
• Art.17 QMS: Cybersecurity measure descriptions can be incorporated by reference into the downstream QMS

Art.55(3): Upstream Obligations Remain Unchanged

Art.55(3) addresses a potential compliance gap: once a GPAI provider transfers information to a downstream provider, does the upstream provider's obligation end?

Art.55(3) answer: No. The upstream GPAI provider's Chapter V obligations under Art.52 and Art.53 continue to apply to the upstream provider independently of what downstream providers do with the information. Art.55(3) prevents the following liability-shifting argument: "We gave the downstream provider all the documentation; it's their responsibility now."

Art.55(3) Obligation Continuity Matrix

Art.55(3) × Art.54 for Non-EU Providers

For non-EU systemic risk GPAI providers that have appointed an Authorised Representative under Art.54, Art.55(3) creates a cooperation loop: the upstream provider's ongoing Art.53 obligations are executed through the Art.54 Representative (who receives and transmits Commission communications), while Art.55(2) downstream disclosures continue to be the provider's direct responsibility.

Non-EU GPAI providers cannot delegate Art.55(2) disclosure obligations to the Art.54 Representative. The Representative handles Commission-facing cooperation (Art.53(1)(a) test results on request, Art.53(1)(b) incident notification). Art.55(2) downstream-facing disclosure is the provider's own operational obligation.

Art.55 × Art.52: The Documentation Chain

Art.55 only functions if Art.52 documentation exists and is current. The chain has three steps:

Art.52 → Art.55 → Downstream AI System Provider
[Create] [Transmit] [Receive + Use]

Step 1 — Art.52 Create: The GPAI provider compiles:

• Annex XI technical documentation (architecture, training, benchmarks, intended purposes, capabilities, limitations)
• Machine-readable model card (Art.52(1)(b))
• Public training data summary (Art.52(3))
• [Systemic risk tier only] Art.53 adversarial test results, cybersecurity documentation, energy data

Step 2 — Art.55 Transmit: The GPAI provider makes the Art.52 documentation package available to downstream integrators — proactively via developer portal, or via structured API response.

Step 3 — Downstream Receive + Use: The downstream AI system provider:

• Receives the Art.52 package (and Art.53 package if systemic risk tier)
• Incorporates GPAI capability/limitation information into own Art.13 IFU documentation for deployers
• Uses adversarial testing summaries as Art.9 risk evidence
• References upstream copyright compliance policy as part of own training data provenance
• Documents receipt in own QMS (Art.17) as supplier documentation

What Happens When Art.52 Documentation Is Missing or Stale

If a GPAI provider has not compiled complete Art.52 documentation, Art.55 compliance is structurally impossible. Downstream providers facing this situation should:

1. Document the gap: Record in own Art.9 risk management file that "upstream provider [name] has not provided Art.55(1) compliant documentation as of [date]"
2. Assess downstream risk: Determine whether absence of upstream documentation creates material gaps in own Art.13 IFU or Art.9 risk assessment
3. Implement compensating controls: Conduct own capability assessment using publicly available benchmarks, academic papers, and provider announcements
4. Consider vendor switching: For high-risk AI use cases (Annex III categories), consider whether a GPAI provider that cannot demonstrate Art.52/55 compliance is an appropriate upstream supplier

Art.55 × Art.54: Non-EU Provider Representative Interface

For downstream integrators of non-EU GPAI APIs (US labs, Canadian foundations), Art.55 and Art.54 interact:

The Art.54 Representative is not an intermediary for Art.55 documentation delivery. The Representative's scope is limited to Commission-facing cooperation (adversarial test results, incident reports, Art.71 registration). Art.55 downstream disclosure is the provider's own direct obligation.

What Downstream SaaS Developers Can Contractually Demand

Art.55 creates legal entitlements that can — and should — be reflected in API contracts and procurement terms:

Art.55(1) Baseline Entitlements (All GPAI Providers)

Art.55(2) Enhanced Entitlements (Systemic Risk GPAI Providers Only)

The Art.55 Vendor Due Diligence Request

Before signing a GPAI API agreement for any EU-facing AI product, downstream developers should request:

1. Annex XI compliance package — does the provider have current documentation?
2. Model card URL — is it machine-readable and version-controlled?
3. Art.55(2) package (if systemic risk tier) — can they demonstrate adversarial testing program exists?
4. Material update notification procedure — what happens when model v2 replaces model v1?
5. Copyright opt-out detection policy — how was TDM opt-out content handled in training?

CLOUD Act × Art.55: Jurisdiction Risk for Information Packages

Art.55 compliance documentation — particularly the Art.55(2) package — creates jurisdiction exposure for both providers and downstream integrators:

EU-native PaaS advantage for downstream integrators: A downstream AI system provider that stores its Art.55(2)-derived compliance documentation on EU-native infrastructure (e.g., sota.io, DE-hosted) operates under a single legal regime. No CLOUD Act warrant can compel the European AI Act compliance files of an EU-established entity storing data in EU territory on EU-incorporated infrastructure. The upstream provider's documents may still be dual-compellable — but the downstream's own compliance records are not.

EU-Native Infrastructure and Art.55 Compliance Documentation

For enterprise customers building high-risk AI systems under Annex III (employment screening, credit scoring, biometric identification, critical infrastructure AI), the storage jurisdiction of Art.55-derived compliance documentation matters:

sota.io provides EU-native containerised compute (Frankfurt, DE) under German and EU law, with no US-incorporated parent entity. Art.55-derived compliance documentation stored and processed via sota.io-deployed workloads is subject exclusively to EU law.

Python Implementation

DownstreamProviderInformationRecord

from dataclasses import dataclass, field
from datetime import date
from typing import Optional
from enum import Enum

class GPAITier(Enum):
    GENERAL = "general"            # Below 10^25 FLOPs
    SYSTEMIC_RISK = "systemic_risk"  # >= 10^25 FLOPs or Commission-designated

class Art55ComplianceStatus(Enum):
    COMPLIANT = "compliant"
    PARTIAL = "partial"
    NON_COMPLIANT = "non_compliant"
    UNKNOWN = "unknown"

@dataclass
class DownstreamProviderInformationRecord:
    """
    Tracks Art.55 EU AI Act information received from an upstream GPAI provider.
    Supports downstream AI system provider's Art.9 risk management and Art.17 QMS.
    """
    provider_name: str
    model_name: str
    model_version: str
    gpai_tier: GPAITier
    integration_date: date
    
    # Art.55(1) — Baseline documentation (all GPAI providers)
    annex_xi_documentation_url: Optional[str] = None
    annex_xi_last_updated: Optional[date] = None
    model_card_url: Optional[str] = None
    model_card_machine_readable: bool = False
    training_data_summary_url: Optional[str] = None
    copyright_policy_url: Optional[str] = None
    
    # Art.55(2) — Enhanced disclosure (systemic risk tier only)
    adversarial_testing_summary_received: bool = False
    adversarial_testing_summary_date: Optional[date] = None
    cybersecurity_measures_description_received: bool = False
    serious_incidents_reported: list = field(default_factory=list)
    energy_efficiency_data_received: bool = False
    
    # Contract terms
    material_update_notification_agreed: bool = False
    art55_clause_in_contract: bool = False
    
    def art55_1_compliance_status(self) -> Art55ComplianceStatus:
        """Assess Art.55(1) baseline compliance for this upstream provider."""
        required = [
            self.annex_xi_documentation_url is not None,
            self.model_card_url is not None,
            self.training_data_summary_url is not None,
            self.copyright_policy_url is not None,
        ]
        if all(required):
            return Art55ComplianceStatus.COMPLIANT
        elif any(required):
            return Art55ComplianceStatus.PARTIAL
        return Art55ComplianceStatus.NON_COMPLIANT
    
    def art55_2_compliance_status(self) -> Art55ComplianceStatus:
        """Assess Art.55(2) enhanced compliance (systemic risk tier only)."""
        if self.gpai_tier != GPAITier.SYSTEMIC_RISK:
            return Art55ComplianceStatus.COMPLIANT  # Not applicable
        required = [
            self.adversarial_testing_summary_received,
            self.cybersecurity_measures_description_received,
        ]
        if all(required):
            return Art55ComplianceStatus.COMPLIANT
        elif any(required):
            return Art55ComplianceStatus.PARTIAL
        return Art55ComplianceStatus.NON_COMPLIANT
    
    def downstream_risk_exposure(self) -> dict:
        """Identify compliance gaps in own obligations due to upstream Art.55 failures."""
        gaps = {}
        if not self.annex_xi_documentation_url:
            gaps["art13_ifu"] = "Cannot fully document AI system capabilities/limitations (no upstream Annex XI)"
        if not self.model_card_url:
            gaps["art9_risk"] = "Art.9 risk management incomplete — no upstream capability/limitation evidence"
        if self.gpai_tier == GPAITier.SYSTEMIC_RISK:
            if not self.adversarial_testing_summary_received:
                gaps["art9_adversarial"] = "No upstream adversarial test evidence — own Art.9 risk assessment has unmitigated gap"
            if not self.cybersecurity_measures_description_received:
                gaps["art15_cybersec"] = "Cannot assess upstream cybersecurity for Art.15 robustness obligations"
        return gaps
    
    def compliance_summary(self) -> str:
        status_1 = self.art55_1_compliance_status().value
        status_2 = self.art55_2_compliance_status().value
        gaps = self.downstream_risk_exposure()
        gap_count = len(gaps)
        return (
            f"Provider: {self.provider_name} | Model: {self.model_name} v{self.model_version}\n"
            f"Tier: {self.gpai_tier.value} | Art.55(1): {status_1} | Art.55(2): {status_2}\n"
            f"Downstream risk gaps: {gap_count} | "
            f"{'No gaps identified' if gap_count == 0 else ', '.join(gaps.keys())}"
        )

GPAIAPIContractAudit

from dataclasses import dataclass
from typing import List, Tuple

@dataclass
class ContractClause:
    clause_ref: str
    present: bool
    text_excerpt: Optional[str] = None
    
@dataclass
class GPAIAPIContractAudit:
    """
    Audits whether a GPAI API contract meets Art.55 information entitlement requirements.
    Use during vendor due diligence for EU AI Act Annex III use cases.
    """
    provider_name: str
    contract_date: date
    gpai_tier: GPAITier
    
    clauses: List[ContractClause] = field(default_factory=list)
    
    # Required Art.55(1) contract provisions
    ART55_1_REQUIRED_CLAUSES = [
        ("annex_xi_access", "Provider grants access to current Annex XI technical documentation"),
        ("model_card_availability", "Provider maintains machine-readable model card per Art.52(1)(b)"),
        ("material_update_notice", "Provider notifies downstream of material model updates"),
        ("copyright_policy_access", "Provider makes TDM opt-out detection policy available"),
        ("training_summary_access", "Provider makes Art.52(3) training data summary available"),
    ]
    
    # Required Art.55(2) contract provisions (systemic risk tier only)
    ART55_2_REQUIRED_CLAUSES = [
        ("adversarial_test_summary", "Provider makes adversarial testing summary available per Art.53(1)(a)"),
        ("cybersecurity_disclosure", "Provider discloses cybersecurity measures per Art.53(1)(c)"),
        ("incident_notification", "Provider notifies downstream of Commission-reported serious incidents"),
        ("energy_data_access", "Provider makes energy efficiency data available per Art.53(1)(d)"),
    ]
    
    def missing_art55_1_clauses(self) -> List[Tuple[str, str]]:
        """Return required Art.55(1) clauses not present in contract."""
        present_refs = {c.clause_ref for c in self.clauses if c.present}
        return [
            (ref, desc) for ref, desc in self.ART55_1_REQUIRED_CLAUSES
            if ref not in present_refs
        ]
    
    def missing_art55_2_clauses(self) -> List[Tuple[str, str]]:
        """Return required Art.55(2) clauses not present (systemic risk tier only)."""
        if self.gpai_tier != GPAITier.SYSTEMIC_RISK:
            return []
        present_refs = {c.clause_ref for c in self.clauses if c.present}
        return [
            (ref, desc) for ref, desc in self.ART55_2_REQUIRED_CLAUSES
            if ref not in present_refs
        ]
    
    def contract_compliance_verdict(self) -> str:
        """
        Returns PASS/PARTIAL/FAIL verdict for Art.55 contract compliance.
        Use in vendor procurement due diligence.
        """
        missing_1 = self.missing_art55_1_clauses()
        missing_2 = self.missing_art55_2_clauses()
        total_missing = len(missing_1) + len(missing_2)
        
        if total_missing == 0:
            return "PASS — Contract contains all required Art.55 entitlement provisions"
        elif total_missing <= 2:
            return f"PARTIAL — {total_missing} required clause(s) missing: {[r for r,_ in missing_1+missing_2]}"
        else:
            return f"FAIL — {total_missing} required clauses missing. Contract does not meet Art.55 minimum requirements."
    
    def remediation_request(self) -> str:
        """Generate text for contract amendment request to upstream provider."""
        missing_1 = self.missing_art55_1_clauses()
        missing_2 = self.missing_art55_2_clauses()
        if not missing_1 and not missing_2:
            return "No remediation required — contract Art.55 compliant."
        
        lines = [
            f"Art.55 EU AI Act Contract Amendment Request — {self.provider_name}",
            f"Date: {self.contract_date}",
            "",
            "The following Art.55 information entitlement provisions are required for EU AI Act compliance",
            "and are not currently present in the API agreement:",
            "",
        ]
        if missing_1:
            lines.append("Art.55(1) Baseline (required for all GPAI providers):")
            for ref, desc in missing_1:
                lines.append(f"  - [{ref}]: {desc}")
        if missing_2:
            lines.append("Art.55(2) Enhanced (required for systemic risk GPAI providers):")
            for ref, desc in missing_2:
                lines.append(f"  - [{ref}]: {desc}")
        return "\n".join(lines)

Art.55 Compliance Checklist (40 Items)

Scope Assessment (Items 1–6)

1. GPAI model identification: Has the upstream model been identified as a GPAI model under Art.3(63)?
2. Tier classification: Has the GPAI model's tier been determined — general (Art.52 only) or systemic risk (Art.52 + Art.53)?
3. FLOPs threshold check: If systemic risk claim is uncertain, has the 10^25 FLOPs threshold been assessed using provider documentation?
4. Art.55 integration trigger: Has the integration intent been documented (signed API agreement, dev tier access, or production call log)?
5. Non-EU provider check: Is the GPAI provider established outside the EU — triggering Art.54 Representative interface?
6. Fine-tune scope: If fine-tuning a GPAI model, has the downstream provider assessed whether the fine-tuned model constitutes a new AI system under Art.3(1)?

Art.55(1) Documentation Receipt (Items 7–16)

1. Annex XI documentation: Has current Annex XI technical documentation been received or accessed from the provider?
2. Documentation currency: Is the Annex XI documentation dated within the last model version release cycle?
3. Model card access: Has the machine-readable model card (Art.52(1)(b)) been accessed and stored?
4. Model card version: Does the model card reflect the current model version being integrated?
5. Training data summary: Has the Art.52(3) public training data summary been accessed?
6. Copyright policy: Has the provider's TDM opt-out detection and licence inventory policy been reviewed?
7. Documentation gap assessment: Have any Annex XI gaps been documented in the own Art.9 risk management file?
8. Proactive availability check: Is the documentation accessible without special request (i.e., on developer portal)?
9. Update notification: Is there a mechanism for receiving updates when documentation changes?
10. EU AI Database check: Has the provider's Art.71 EU AI Database registration been verified?

Art.55(2) Enhanced Information (Items 17–24, Systemic Risk Tier)

1. Adversarial test summary: Has the Art.53(1)(a) adversarial testing summary been received?
2. Adversarial test recency: Is the adversarial test summary from the current model version's test cycle?
3. Cybersecurity disclosure: Has the Art.53(1)(c) cybersecurity measures description been received?
4. Model weight protection: Does the cybersecurity disclosure address model weight protection specifically?
5. Inference API security: Does the cybersecurity disclosure address prompt injection and inference manipulation?
6. Serious incident history: Has the provider disclosed any Commission-reported serious incidents?
7. Energy efficiency data: Has Art.53(1)(d) energy efficiency data been received?
8. Art.55(2) gap documentation: Have any Art.55(2) disclosure gaps been documented in the downstream Art.9 risk file?

Downstream Integration of Upstream Information (Items 25–32)

1. Art.9 integration: Has upstream adversarial testing summary been incorporated into own Art.9 risk assessment?
2. Art.13 IFU population: Has upstream model capability/limitation information populated own Art.13 Instructions for Use?
3. Art.12 logging scope: Has upstream incident history informed own Art.12 logging event categories?
4. Art.15 robustness: Has upstream cybersecurity documentation been assessed for own Art.15 robustness gap analysis?
5. Art.17 QMS record: Is upstream documentation referenced in own Art.17 QMS supplier documentation records?
6. Art.26 deployer obligations: If own product is B2B SaaS (downstream deployer), has upstream information informed deployer IFU?
7. Substantial modification tracking: Has a monitoring process been established to detect when upstream model version change triggers Art.3(23) substantial modification?
8. Art.48 DoC reference: Does the own Art.48 Declaration of Conformity correctly reference the upstream GPAI model version and Art.55 compliance status?

Contract and Commercial Terms (Items 33–37)

1. Art.55 clause present: Does the API contract include explicit Art.55 information entitlement provisions?
2. Material update notice: Does the contract require provider notification of material model updates (Art.3(23) triggers)?
3. Incident notification SLA: Does the contract specify an incident notification timeline (recommended: 48 hours)?
4. Documentation access SLA: Does the contract specify how quickly Annex XI documentation is available on request?
5. Remediation procedure: Does the contract specify remediation if Art.55 documentation is not provided?

CLOUD Act and Jurisdiction (Items 38–40)

1. Documentation storage jurisdiction: Is own Art.55-derived compliance documentation (Art.9 risk file, Art.13 IFU) stored on EU-native infrastructure?
2. CLOUD Act assessment: Has the CLOUD Act jurisdiction risk of the upstream provider's infrastructure been assessed for the adversarial test records and incident reports?
3. EU-native alternative: For Annex III high-risk use cases, has EU-native GPAI infrastructure been evaluated as a CLOUD Act-free alternative to US-infrastructure GPAI APIs?

Art.55 × Art.29 × Art.26: The Full Downstream Obligation Chain

Art.55 is the upstream-facing boundary. Downstream providers also have obligations toward their own downstream:

GPAI Provider [Art.52 + Art.53]
    ↓ Art.55 information flow
AI System Provider (downstream integrator)
    [Art.9 risk + Art.13 IFU + Art.12 logging + Art.17 QMS]
    ↓ Art.29 instructions for use → Deployer
Deployer (enterprise customer)
    [Art.26 deployer obligations + Art.14 human oversight]
    ↓ Art.50 disclosure → End User
End User
    [Right to explanation Art.86, GDPR Art.22 rights]

The Art.55(2) adversarial testing summary that flows from a systemic risk GPAI provider to an AI system developer becomes evidence in that developer's Art.9 risk assessment, which in turn informs the Art.13 IFU delivered to deployers under Art.29, which informs the deployer's Art.26 compliance (including the decision whether human oversight under Art.14 is adequate given the upstream model's known risk profile). The entire downstream compliance chain depends on Art.55 functioning as designed.

See Also

• EU AI Act Art.52 GPAI Model General Obligations: Technical Documentation, Training Data & Copyright
• EU AI Act Art.53 GPAI Models with Systemic Risk: Adversarial Testing, Incident Reporting & Cybersecurity
• EU AI Act Art.54 GPAI Authorised Representative: Non-EU Provider Obligations
• EU AI Act Art.26 Obligations for Deployers Developer Guide
• EU AI Act Art.9 Risk Management System for High-Risk AI Developer Guide